Update "timestamp" field by query (subtract time from the original field and reindex)

Elastic Stack Elasticsearch
1

Hi,

I'm trying to create a rest call that will perform the following.

  1. find all documents that match a simple query of field:value.
  2. in those documents, update the value of the "timestamp" field to be timestamp - 1 minute.

I was thinking to do this with the update by query api, I'm just not sure how to write the painless script to do the subtraction update of the timestamp field.

any help appreciated.

thanks!

2

Something like this should work:

POST my_index/_update_by_query
{
  "query": {
    "match": {
      "field": "value"
    }
  },
  "script": {
    "source": "ctx._source.timestamp = OffsetDateTime.parse(ctx._source.timestamp).minusMinutes(1)"
  }
}
3

thank you very much!

4

actually got an error while trying to run this...

{
"error": {
	"root_cause": [{
		"type": "script_exception",
		"reason": "runtime error",
		"script_stack": ["java.util.Objects.requireNonNull(Objects.java:228)", "java.time.format.DateTimeFormatter.parse(DateTimeFormatter.java:1848)", "java.time.OffsetDateTime.parse(OffsetDateTime.java:402)", "java.time.OffsetDateTime.parse(OffsetDateTime.java:387)", "ctx._timestamp = OffsetDateTime.parse(ctx._timestamp).minusMinutes(3)", "                                          ^---- HERE"],
		"script": "ctx._timestamp = OffsetDateTime.parse(ctx._timestamp).minusMinutes(3)",
		"lang": "painless"
	}],
	"type": "script_exception",
	"reason": "runtime error",
	"script_stack": ["java.util.Objects.requireNonNull(Objects.java:228)", "java.time.format.DateTimeFormatter.parse(DateTimeFormatter.java:1848)", "java.time.OffsetDateTime.parse(OffsetDateTime.java:402)", "java.time.OffsetDateTime.parse(OffsetDateTime.java:387)", "ctx._timestamp = OffsetDateTime.parse(ctx._timestamp).minusMinutes(3)", "                                          ^---- HERE"],
	"script": "ctx._timestamp = OffsetDateTime.parse(ctx._timestamp).minusMinutes(3)",
	"lang": "painless",
	"caused_by": {
		"type": "null_pointer_exception",
		"reason": "text"
	}
},
"status": 500
}

any idea what can be the issue here?

5

You are using ctx._timestamp instead of ctx._source.timestamp (or ctx._source.fieldname, where fieldname is the name of the timestamp field you are trying to update).

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.